[PATCH v2] rust: auxiliary: validate DeviceId name length

[PATCH v2] rust: auxiliary: validate DeviceId name length

[Georgios Androutsopoulos]

`DeviceId::new()` copies `modname` and `name` into the fixed 40-byte
`auxiliary_device_id::name` array without checking that they fit. An
oversized name is caught by the array bounds check, but the error
reports an out-of-bounds index in the copy loop rather than the
constraint the caller violated.

Check the invariant explicitly instead, so the failure states the length
limit rather than an array index.

This should only be reached when constructing a device ID table, so the
failure is a compile time error. Document that intent.

Signed-off-by: Georgios Androutsopoulos <georgeandrout13@gmail.com>
---
Changes in v2:
- Drop Fixes: following feedback from Danilo Krummrich and Alexandre
  Courbot.
- Replace the `# Panics` section with a note that this is for device ID
  table construction, following feedback from Danilo Krummrich and Gary
  Guo.
- Reword the commit message so it does not suggest runtime evaluation,
  following feedback from Alexandre Courbot.
- Link to v1: https://lore.kernel.org/rust-for-linux/20260909033246.2779303-1-georgeandrout13@gmail.com/
---
 rust/kernel/auxiliary.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/rust/kernel/auxiliary.rs b/rust/kernel/auxiliary.rs
index 60dfbec8f330..2ace0428e45e 100644
--- a/rust/kernel/auxiliary.rs
+++ b/rust/kernel/auxiliary.rs
@@ -137,10 +137,18 @@ macro_rules! module_auxiliary_driver {
 
 impl DeviceId {
     /// Create a new [`DeviceId`] from name.
+    ///
+    /// This is only intended to be called in const context, when constructing a
+    /// device ID table, where exceeding `AUXILIARY_NAME_SIZE` is a compile time error.
     pub const fn new(modname: &'static CStr, name: &'static CStr) -> Self {
         let name = name.to_bytes_with_nul();
         let modname = modname.to_bytes_with_nul();
 
+        assert!(
+            modname.len().saturating_add(name.len()) <= bindings::AUXILIARY_NAME_SIZE as usize,
+            "auxiliary device ID is too long"
+        );
+
         let mut id: bindings::auxiliary_device_id = pin_init::zeroed();
         let mut i = 0;
         while i < modname.len() {

base-commit: 28924df2a08f440c73991b83028032c901de2ae4
-- 
2.47.3

Re: [PATCH v2] rust: auxiliary: validate DeviceId name length

[Alexandre Courbot]

On Fri Sep 11, 2026 at 12:38 AM JST, Georgios Androutsopoulos wrote:
> `DeviceId::new()` copies `modname` and `name` into the fixed 40-byte
> `auxiliary_device_id::name` array without checking that they fit. An
> oversized name is caught by the array bounds check, but the error
> reports an out-of-bounds index in the copy loop rather than the
> constraint the caller violated.
>
> Check the invariant explicitly instead, so the failure states the length
> limit rather than an array index.
>
> This should only be reached when constructing a device ID table, so the
> failure is a compile time error. Document that intent.
>
> Signed-off-by: Georgios Androutsopoulos <georgeandrout13@gmail.com>

That's not an essential change, but its concise and helpful to some
degree, so:

Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>

Re: [PATCH v2] rust: auxiliary: validate DeviceId name length

[Danilo Krummrich]

On Thu, 10 Sep 2026 11:38:44 -0400, Georgios Androutsopoulos wrote:
> [PATCH v2] rust: auxiliary: validate DeviceId name length

Applied, thanks!

  Branch: driver-core-testing
  Tree:   git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git

[1/1] rust: auxiliary: validate DeviceId name length
      commit: a4aaec5580d8

The patch will appear in the next linux-next integration (typically within 24
hours on weekdays).

The patch is in the driver-core-testing branch and will be promoted to
driver-core-next after validation.